mirror of
https://github.com/flatcar/scripts.git
synced 2025-10-18 19:01:28 +02:00
net-firewall/iptables: Sync with Gentoo
It's from Gentoo commit a3da784f72dee09cce92063e6702aac3738dc205.
This commit is contained in:
Flatcar Buildbot
Krzesimir Nowak
parent
a49e6f94af
commit
8dc93ee0ba
@ -1,3 +1 @@
|
|||||||
DIST iptables-1.8.10.tar.xz 641168 BLAKE2B 417b33fcfc7edeba169caef26ed0322798f6b82500840509f6c10b97b4ef3f11932c0393fc8dcc5946264442bf8ee959a594b6fbd5dc92012cfad30edf130520 SHA512 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153
|
|
||||||
DIST iptables-1.8.11.tar.xz 649284 BLAKE2B 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae2645ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1 SHA512 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
|
DIST iptables-1.8.11.tar.xz 649284 BLAKE2B 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae2645ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1 SHA512 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
|
||||||
DIST iptables-1.8.9.tar.xz 637848 BLAKE2B 37ba80be0ee7049c4d3ee5689b273b4d2cc6e6fb9ebb297e86976b5750f987f2ae4536013fe1749ae79b6989c241eaece3202019fafd47d842c7a4fe3e5093b1 SHA512 e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70
|
|
||||||
|
|||||||
@ -1,34 +0,0 @@
|
|||||||
https://git.netfilter.org/iptables/commit/?id=78850e7dba64a949c440dbdbe557f59409c6db48
|
|
||||||
|
|
||||||
From 78850e7dba64a949c440dbdbe557f59409c6db48 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Markus Boehme <markubo@amazon.com>
|
|
||||||
Date: Mon, 3 Apr 2023 23:13:47 +0200
|
|
||||||
Subject: [PATCH] ip6tables: Fix checking existence of rule
|
|
||||||
|
|
||||||
Pass the proper entry size when creating a match mask for checking the
|
|
||||||
existence of a rule. Failing to do so causes wrong results.
|
|
||||||
|
|
||||||
Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com>
|
|
||||||
Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables")
|
|
||||||
Signed-off-by: Markus Boehme <markubo@amazon.com>
|
|
||||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
||||||
---
|
|
||||||
iptables/ip6tables.c | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
|
|
||||||
index 345af451..9afc32c1 100644
|
|
||||||
--- a/iptables/ip6tables.c
|
|
||||||
+++ b/iptables/ip6tables.c
|
|
||||||
@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
|
|
||||||
int ret = 1;
|
|
||||||
unsigned char *mask;
|
|
||||||
|
|
||||||
- mask = make_delete_mask(matches, target, sizeof(fw));
|
|
||||||
+ mask = make_delete_mask(matches, target, sizeof(*fw));
|
|
||||||
for (i = 0; i < nsaddrs; i++) {
|
|
||||||
fw->ipv6.src = saddrs[i];
|
|
||||||
fw->ipv6.smsk = smasks[i];
|
|
||||||
--
|
|
||||||
2.42.0.283.g2d96d420d3-goog
|
|
||||||
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
https://git.netfilter.org/iptables/commit/?id=ed4082a7405a5838c205a34c1559e289949200cc
|
|
||||||
|
|
||||||
From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001
|
|
||||||
From: Phil Sutter <phil@nwl.cc>
|
|
||||||
Date: Thu, 12 Jan 2023 14:38:44 +0100
|
|
||||||
Subject: extensions: NAT: Fix for -Werror=format-security
|
|
||||||
|
|
||||||
Have to pass either a string literal or format string to xt_xlate_add().
|
|
||||||
|
|
||||||
Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE")
|
|
||||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
||||||
--- a/extensions/libxt_NAT.c
|
|
||||||
+++ b/extensions/libxt_NAT.c
|
|
||||||
@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r,
|
|
||||||
if (r->flags & NF_NAT_RANGE_PROTO_OFFSET)
|
|
||||||
return 0;
|
|
||||||
|
|
||||||
- xt_xlate_add(xl, tgt);
|
|
||||||
+ xt_xlate_add(xl, "%s", tgt);
|
|
||||||
if (strlen(range_str))
|
|
||||||
xt_xlate_add(xl, " to %s", range_str);
|
|
||||||
if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) {
|
|
||||||
--
|
|
||||||
cgit v1.2.3
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,179 +0,0 @@
|
|||||||
# Copyright 1999-2024 Gentoo Authors
|
|
||||||
# Distributed under the terms of the GNU General Public License v2
|
|
||||||
|
|
||||||
EAPI=8
|
|
||||||
|
|
||||||
inherit systemd toolchain-funcs autotools flag-o-matic
|
|
||||||
|
|
||||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
|
||||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
|
||||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
|
|
||||||
|
|
||||||
LICENSE="GPL-2"
|
|
||||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
|
||||||
# the last time.
|
|
||||||
SLOT="0/1.8.3"
|
|
||||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
|
|
||||||
IUSE="conntrack netlink nftables pcap static-libs test"
|
|
||||||
RESTRICT="!test? ( test )"
|
|
||||||
# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
|
|
||||||
REQUIRED_USE="test? ( conntrack nftables )"
|
|
||||||
|
|
||||||
COMMON_DEPEND="
|
|
||||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
|
||||||
netlink? ( net-libs/libnfnetlink )
|
|
||||||
nftables? (
|
|
||||||
>=net-libs/libmnl-1.0:=
|
|
||||||
>=net-libs/libnftnl-1.2.6:=
|
|
||||||
)
|
|
||||||
pcap? ( net-libs/libpcap )
|
|
||||||
"
|
|
||||||
DEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
virtual/os-headers
|
|
||||||
>=sys-kernel/linux-headers-4.4:0
|
|
||||||
"
|
|
||||||
BDEPEND="
|
|
||||||
virtual/pkgconfig
|
|
||||||
nftables? (
|
|
||||||
app-alternatives/lex
|
|
||||||
app-alternatives/yacc
|
|
||||||
)
|
|
||||||
"
|
|
||||||
RDEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
nftables? ( net-misc/ethertypes )
|
|
||||||
!<net-firewall/ebtables-2.0.11-r1
|
|
||||||
!<net-firewall/arptables-0.0.5-r1
|
|
||||||
"
|
|
||||||
IDEPEND=">=app-eselect/eselect-iptables-20220320"
|
|
||||||
|
|
||||||
PATCHES=(
|
|
||||||
"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
|
|
||||||
)
|
|
||||||
|
|
||||||
src_prepare() {
|
|
||||||
# Use the saner headers from the kernel
|
|
||||||
rm include/linux/{kernel,types}.h || die
|
|
||||||
|
|
||||||
default
|
|
||||||
eautoreconf
|
|
||||||
}
|
|
||||||
|
|
||||||
src_configure() {
|
|
||||||
# Some libs use $(AR) rather than libtool to build, bug #444282
|
|
||||||
tc-export AR
|
|
||||||
|
|
||||||
# Hack around struct mismatches between userland & kernel for some ABIs
|
|
||||||
# bug #472388
|
|
||||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
|
||||||
|
|
||||||
sed -i \
|
|
||||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
|
||||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
|
||||||
configure || die
|
|
||||||
|
|
||||||
local myeconfargs=(
|
|
||||||
--sbindir="${EPREFIX}/sbin"
|
|
||||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
|
||||||
--enable-devel
|
|
||||||
--enable-ipv6
|
|
||||||
--enable-shared
|
|
||||||
$(use_enable nftables)
|
|
||||||
$(use_enable pcap bpf-compiler)
|
|
||||||
$(use_enable pcap nfsynproxy)
|
|
||||||
$(use_enable static-libs static)
|
|
||||||
)
|
|
||||||
|
|
||||||
econf "${myeconfargs[@]}"
|
|
||||||
}
|
|
||||||
|
|
||||||
src_compile() {
|
|
||||||
emake V=1
|
|
||||||
}
|
|
||||||
|
|
||||||
src_install() {
|
|
||||||
default
|
|
||||||
|
|
||||||
# Managed by eselect-iptables
|
|
||||||
# https://bugs.gentoo.org/881295
|
|
||||||
rm "${ED}/usr/bin/iptables-xml" || die
|
|
||||||
|
|
||||||
dodoc iptables/iptables.xslt
|
|
||||||
|
|
||||||
# All the iptables binaries are in /sbin, so might as well
|
|
||||||
# put these small files in with them
|
|
||||||
into /
|
|
||||||
dosbin iptables/iptables-apply
|
|
||||||
dosym iptables-apply /sbin/ip6tables-apply
|
|
||||||
doman iptables/iptables-apply.8
|
|
||||||
|
|
||||||
insinto /usr/include
|
|
||||||
doins include/ip{,6}tables.h
|
|
||||||
insinto /usr/include/iptables
|
|
||||||
doins include/iptables/internal.h
|
|
||||||
|
|
||||||
keepdir /var/lib/ip{,6}tables
|
|
||||||
newinitd "${FILESDIR}"/${PN}-r3.init iptables
|
|
||||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
|
||||||
dosym iptables /etc/init.d/ip6tables
|
|
||||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
# Bug #647458
|
|
||||||
rm "${ED}"/etc/ethertypes || die
|
|
||||||
|
|
||||||
# Bugs #660886 and #669894
|
|
||||||
rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
|
|
||||||
fi
|
|
||||||
|
|
||||||
systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
|
|
||||||
|
|
||||||
find "${ED}" -type f -name "*.la" -delete || die
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_postinst() {
|
|
||||||
local default_iptables="xtables-legacy-multi"
|
|
||||||
if ! eselect iptables show &>/dev/null; then
|
|
||||||
elog "Current iptables implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect iptables set "${default_iptables}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
local tables
|
|
||||||
for tables in {arp,eb}tables; do
|
|
||||||
if ! eselect ${tables} show &>/dev/null; then
|
|
||||||
elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect ${tables} set xtables-nft-multi
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
eselect iptables show
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_prerm() {
|
|
||||||
if [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Unsetting iptables symlinks before removal"
|
|
||||||
eselect iptables unset
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/ebtables'; then
|
|
||||||
elog "Unsetting ebtables symlinks before removal"
|
|
||||||
eselect ebtables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting ebtables symlinks to ebtables-legacy"
|
|
||||||
eselect ebtables set ebtables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/arptables'; then
|
|
||||||
elog "Unsetting arptables symlinks before removal"
|
|
||||||
eselect arptables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting arptables symlinks to arptables-legacy"
|
|
||||||
eselect arptables set arptables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
# The eselect module failing should not be fatal
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
@ -1,182 +0,0 @@
|
|||||||
# Copyright 1999-2024 Gentoo Authors
|
|
||||||
# Distributed under the terms of the GNU General Public License v2
|
|
||||||
|
|
||||||
EAPI=8
|
|
||||||
|
|
||||||
inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript
|
|
||||||
|
|
||||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
|
||||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
|
||||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
|
|
||||||
|
|
||||||
LICENSE="GPL-2"
|
|
||||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
|
||||||
# the last time.
|
|
||||||
SLOT="0/1.8.3"
|
|
||||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
|
|
||||||
IUSE="conntrack netlink nftables pcap static-libs test"
|
|
||||||
RESTRICT="!test? ( test )"
|
|
||||||
# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
|
|
||||||
REQUIRED_USE="test? ( conntrack nftables )"
|
|
||||||
|
|
||||||
COMMON_DEPEND="
|
|
||||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
|
||||||
netlink? ( net-libs/libnfnetlink )
|
|
||||||
nftables? (
|
|
||||||
>=net-libs/libmnl-1.0:=
|
|
||||||
>=net-libs/libnftnl-1.2.6:=
|
|
||||||
)
|
|
||||||
pcap? ( net-libs/libpcap )
|
|
||||||
"
|
|
||||||
DEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
virtual/os-headers
|
|
||||||
>=sys-kernel/linux-headers-4.4:0
|
|
||||||
"
|
|
||||||
BDEPEND="
|
|
||||||
virtual/pkgconfig
|
|
||||||
nftables? (
|
|
||||||
app-alternatives/lex
|
|
||||||
app-alternatives/yacc
|
|
||||||
)
|
|
||||||
"
|
|
||||||
RDEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
nftables? ( net-misc/ethertypes )
|
|
||||||
!<net-firewall/ebtables-2.0.11-r1
|
|
||||||
!<net-firewall/arptables-0.0.5-r1
|
|
||||||
"
|
|
||||||
IDEPEND=">=app-eselect/eselect-iptables-20220320"
|
|
||||||
|
|
||||||
PATCHES=(
|
|
||||||
"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
|
|
||||||
)
|
|
||||||
|
|
||||||
src_prepare() {
|
|
||||||
# Use the saner headers from the kernel
|
|
||||||
rm include/linux/{kernel,types}.h || die
|
|
||||||
|
|
||||||
default
|
|
||||||
eautoreconf
|
|
||||||
}
|
|
||||||
|
|
||||||
src_configure() {
|
|
||||||
# Some libs use $(AR) rather than libtool to build, bug #444282
|
|
||||||
tc-export AR
|
|
||||||
|
|
||||||
# Hack around struct mismatches between userland & kernel for some ABIs
|
|
||||||
# bug #472388
|
|
||||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
|
||||||
|
|
||||||
sed -i \
|
|
||||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
|
||||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
|
||||||
configure || die
|
|
||||||
|
|
||||||
local myeconfargs=(
|
|
||||||
--sbindir="${EPREFIX}/sbin"
|
|
||||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
|
||||||
--enable-devel
|
|
||||||
--enable-ipv6
|
|
||||||
--enable-shared
|
|
||||||
$(use_enable nftables)
|
|
||||||
$(use_enable pcap bpf-compiler)
|
|
||||||
$(use_enable pcap nfsynproxy)
|
|
||||||
$(use_enable static-libs static)
|
|
||||||
)
|
|
||||||
|
|
||||||
econf "${myeconfargs[@]}"
|
|
||||||
}
|
|
||||||
|
|
||||||
src_compile() {
|
|
||||||
emake V=1
|
|
||||||
}
|
|
||||||
|
|
||||||
src_install() {
|
|
||||||
default
|
|
||||||
|
|
||||||
# Managed by eselect-iptables
|
|
||||||
# https://bugs.gentoo.org/881295
|
|
||||||
rm "${ED}/usr/bin/iptables-xml" || die
|
|
||||||
|
|
||||||
dodoc iptables/iptables.xslt
|
|
||||||
|
|
||||||
# All the iptables binaries are in /sbin, so might as well
|
|
||||||
# put these small files in with them
|
|
||||||
into /
|
|
||||||
dosbin iptables/iptables-apply
|
|
||||||
dosym iptables-apply /sbin/ip6tables-apply
|
|
||||||
doman iptables/iptables-apply.8
|
|
||||||
|
|
||||||
insinto /usr/include
|
|
||||||
doins include/ip{,6}tables.h
|
|
||||||
insinto /usr/include/iptables
|
|
||||||
doins include/iptables/internal.h
|
|
||||||
|
|
||||||
keepdir /var/lib/ip{,6}tables
|
|
||||||
newinitd "${FILESDIR}"/${PN}-r3.init iptables
|
|
||||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
|
||||||
dosym iptables /etc/init.d/ip6tables
|
|
||||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
# Bug #647458
|
|
||||||
rm "${ED}"/etc/ethertypes || die
|
|
||||||
|
|
||||||
# Bugs #660886 and #669894
|
|
||||||
rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
|
|
||||||
fi
|
|
||||||
|
|
||||||
systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
|
|
||||||
|
|
||||||
# Move important libs to /lib, bug #332175
|
|
||||||
gen_usr_ldscript -a ip{4,6}tc xtables
|
|
||||||
|
|
||||||
find "${ED}" -type f -name "*.la" -delete || die
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_postinst() {
|
|
||||||
local default_iptables="xtables-legacy-multi"
|
|
||||||
if ! eselect iptables show &>/dev/null; then
|
|
||||||
elog "Current iptables implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect iptables set "${default_iptables}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
local tables
|
|
||||||
for tables in {arp,eb}tables; do
|
|
||||||
if ! eselect ${tables} show &>/dev/null; then
|
|
||||||
elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect ${tables} set xtables-nft-multi
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
eselect iptables show
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_prerm() {
|
|
||||||
if [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Unsetting iptables symlinks before removal"
|
|
||||||
eselect iptables unset
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/ebtables'; then
|
|
||||||
elog "Unsetting ebtables symlinks before removal"
|
|
||||||
eselect ebtables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting ebtables symlinks to ebtables-legacy"
|
|
||||||
eselect ebtables set ebtables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/arptables'; then
|
|
||||||
elog "Unsetting arptables symlinks before removal"
|
|
||||||
eselect arptables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting arptables symlinks to arptables-legacy"
|
|
||||||
eselect arptables set arptables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
# The eselect module failing should not be fatal
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
@ -1,181 +0,0 @@
|
|||||||
# Copyright 1999-2024 Gentoo Authors
|
|
||||||
# Distributed under the terms of the GNU General Public License v2
|
|
||||||
|
|
||||||
EAPI=8
|
|
||||||
|
|
||||||
inherit systemd toolchain-funcs autotools flag-o-matic
|
|
||||||
|
|
||||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
|
||||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
|
||||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
|
|
||||||
|
|
||||||
LICENSE="GPL-2"
|
|
||||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
|
||||||
# the last time.
|
|
||||||
SLOT="0/1.8.3"
|
|
||||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
|
|
||||||
IUSE="conntrack netlink nftables pcap static-libs test"
|
|
||||||
RESTRICT="!test? ( test )"
|
|
||||||
# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
|
|
||||||
REQUIRED_USE="test? ( conntrack nftables )"
|
|
||||||
|
|
||||||
COMMON_DEPEND="
|
|
||||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
|
||||||
netlink? ( net-libs/libnfnetlink )
|
|
||||||
nftables? (
|
|
||||||
>=net-libs/libmnl-1.0:=
|
|
||||||
>=net-libs/libnftnl-1.1.6:=
|
|
||||||
)
|
|
||||||
pcap? ( net-libs/libpcap )
|
|
||||||
"
|
|
||||||
DEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
virtual/os-headers
|
|
||||||
>=sys-kernel/linux-headers-4.4:0
|
|
||||||
"
|
|
||||||
BDEPEND="
|
|
||||||
virtual/pkgconfig
|
|
||||||
nftables? (
|
|
||||||
app-alternatives/lex
|
|
||||||
app-alternatives/yacc
|
|
||||||
)
|
|
||||||
"
|
|
||||||
RDEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
nftables? ( net-misc/ethertypes )
|
|
||||||
!<net-firewall/ebtables-2.0.11-r1
|
|
||||||
!<net-firewall/arptables-0.0.5-r1
|
|
||||||
"
|
|
||||||
IDEPEND=">=app-eselect/eselect-iptables-20220320"
|
|
||||||
|
|
||||||
PATCHES=(
|
|
||||||
"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
|
|
||||||
"${FILESDIR}"/${P}-format-security.patch
|
|
||||||
"${FILESDIR}"/${PN}-1.8.9-fix-checking-existence-of-rule.patch
|
|
||||||
)
|
|
||||||
|
|
||||||
src_prepare() {
|
|
||||||
# Use the saner headers from the kernel
|
|
||||||
rm include/linux/{kernel,types}.h || die
|
|
||||||
|
|
||||||
default
|
|
||||||
eautoreconf
|
|
||||||
}
|
|
||||||
|
|
||||||
src_configure() {
|
|
||||||
# Some libs use $(AR) rather than libtool to build, bug #444282
|
|
||||||
tc-export AR
|
|
||||||
|
|
||||||
# Hack around struct mismatches between userland & kernel for some ABIs
|
|
||||||
# bug #472388
|
|
||||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
|
||||||
|
|
||||||
sed -i \
|
|
||||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
|
||||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
|
||||||
configure || die
|
|
||||||
|
|
||||||
local myeconfargs=(
|
|
||||||
--sbindir="${EPREFIX}/sbin"
|
|
||||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
|
||||||
--enable-devel
|
|
||||||
--enable-ipv6
|
|
||||||
--enable-shared
|
|
||||||
$(use_enable nftables)
|
|
||||||
$(use_enable pcap bpf-compiler)
|
|
||||||
$(use_enable pcap nfsynproxy)
|
|
||||||
$(use_enable static-libs static)
|
|
||||||
)
|
|
||||||
|
|
||||||
econf "${myeconfargs[@]}"
|
|
||||||
}
|
|
||||||
|
|
||||||
src_compile() {
|
|
||||||
emake V=1
|
|
||||||
}
|
|
||||||
|
|
||||||
src_install() {
|
|
||||||
default
|
|
||||||
|
|
||||||
# Managed by eselect-iptables
|
|
||||||
# https://bugs.gentoo.org/881295
|
|
||||||
rm "${ED}/usr/bin/iptables-xml" || die
|
|
||||||
|
|
||||||
dodoc iptables/iptables.xslt
|
|
||||||
|
|
||||||
# All the iptables binaries are in /sbin, so might as well
|
|
||||||
# put these small files in with them
|
|
||||||
into /
|
|
||||||
dosbin iptables/iptables-apply
|
|
||||||
dosym iptables-apply /sbin/ip6tables-apply
|
|
||||||
doman iptables/iptables-apply.8
|
|
||||||
|
|
||||||
insinto /usr/include
|
|
||||||
doins include/ip{,6}tables.h
|
|
||||||
insinto /usr/include/iptables
|
|
||||||
doins include/iptables/internal.h
|
|
||||||
|
|
||||||
keepdir /var/lib/ip{,6}tables
|
|
||||||
newinitd "${FILESDIR}"/${PN}-r3.init iptables
|
|
||||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
|
||||||
dosym iptables /etc/init.d/ip6tables
|
|
||||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
# Bug #647458
|
|
||||||
rm "${ED}"/etc/ethertypes || die
|
|
||||||
|
|
||||||
# Bugs #660886 and #669894
|
|
||||||
rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
|
|
||||||
fi
|
|
||||||
|
|
||||||
systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
|
|
||||||
|
|
||||||
find "${ED}" -type f -name "*.la" -delete || die
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_postinst() {
|
|
||||||
local default_iptables="xtables-legacy-multi"
|
|
||||||
if ! eselect iptables show &>/dev/null; then
|
|
||||||
elog "Current iptables implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect iptables set "${default_iptables}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
local tables
|
|
||||||
for tables in {arp,eb}tables; do
|
|
||||||
if ! eselect ${tables} show &>/dev/null; then
|
|
||||||
elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect ${tables} set xtables-nft-multi
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
eselect iptables show
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_prerm() {
|
|
||||||
if [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Unsetting iptables symlinks before removal"
|
|
||||||
eselect iptables unset
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/ebtables'; then
|
|
||||||
elog "Unsetting ebtables symlinks before removal"
|
|
||||||
eselect ebtables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting ebtables symlinks to ebtables-legacy"
|
|
||||||
eselect ebtables set ebtables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/arptables'; then
|
|
||||||
elog "Unsetting arptables symlinks before removal"
|
|
||||||
eselect arptables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting arptables symlinks to arptables-legacy"
|
|
||||||
eselect arptables set arptables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
# The eselect module failing should not be fatal
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
@ -1,180 +0,0 @@
|
|||||||
# Copyright 1999-2024 Gentoo Authors
|
|
||||||
# Distributed under the terms of the GNU General Public License v2
|
|
||||||
|
|
||||||
EAPI=8
|
|
||||||
|
|
||||||
inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript
|
|
||||||
|
|
||||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
|
||||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
|
||||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
|
|
||||||
|
|
||||||
LICENSE="GPL-2"
|
|
||||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
|
||||||
# the last time.
|
|
||||||
SLOT="0/1.8.3"
|
|
||||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
|
|
||||||
IUSE="conntrack netlink nftables pcap static-libs"
|
|
||||||
|
|
||||||
COMMON_DEPEND="
|
|
||||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
|
||||||
netlink? ( net-libs/libnfnetlink )
|
|
||||||
nftables? (
|
|
||||||
>=net-libs/libmnl-1.0:=
|
|
||||||
>=net-libs/libnftnl-1.1.6:=
|
|
||||||
)
|
|
||||||
pcap? ( net-libs/libpcap )
|
|
||||||
"
|
|
||||||
DEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
virtual/os-headers
|
|
||||||
>=sys-kernel/linux-headers-4.4:0
|
|
||||||
"
|
|
||||||
BDEPEND="
|
|
||||||
virtual/pkgconfig
|
|
||||||
nftables? (
|
|
||||||
app-alternatives/lex
|
|
||||||
app-alternatives/yacc
|
|
||||||
)
|
|
||||||
"
|
|
||||||
RDEPEND="
|
|
||||||
${COMMON_DEPEND}
|
|
||||||
nftables? ( net-misc/ethertypes )
|
|
||||||
!<net-firewall/ebtables-2.0.11-r1
|
|
||||||
!<net-firewall/arptables-0.0.5-r1
|
|
||||||
"
|
|
||||||
IDEPEND=">=app-eselect/eselect-iptables-20220320"
|
|
||||||
|
|
||||||
PATCHES=(
|
|
||||||
"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
|
|
||||||
"${FILESDIR}"/${P}-format-security.patch
|
|
||||||
)
|
|
||||||
|
|
||||||
src_prepare() {
|
|
||||||
# Use the saner headers from the kernel
|
|
||||||
rm include/linux/{kernel,types}.h || die
|
|
||||||
|
|
||||||
default
|
|
||||||
eautoreconf
|
|
||||||
}
|
|
||||||
|
|
||||||
src_configure() {
|
|
||||||
# Some libs use $(AR) rather than libtool to build, bug #444282
|
|
||||||
tc-export AR
|
|
||||||
|
|
||||||
# Hack around struct mismatches between userland & kernel for some ABIs
|
|
||||||
# bug #472388
|
|
||||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
|
||||||
|
|
||||||
sed -i \
|
|
||||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
|
||||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
|
||||||
configure || die
|
|
||||||
|
|
||||||
local myeconfargs=(
|
|
||||||
--sbindir="${EPREFIX}/sbin"
|
|
||||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
|
||||||
--enable-devel
|
|
||||||
--enable-ipv6
|
|
||||||
--enable-shared
|
|
||||||
$(use_enable nftables)
|
|
||||||
$(use_enable pcap bpf-compiler)
|
|
||||||
$(use_enable pcap nfsynproxy)
|
|
||||||
$(use_enable static-libs static)
|
|
||||||
)
|
|
||||||
|
|
||||||
econf "${myeconfargs[@]}"
|
|
||||||
}
|
|
||||||
|
|
||||||
src_compile() {
|
|
||||||
emake V=1
|
|
||||||
}
|
|
||||||
|
|
||||||
src_install() {
|
|
||||||
default
|
|
||||||
|
|
||||||
# Managed by eselect-iptables
|
|
||||||
# https://bugs.gentoo.org/881295
|
|
||||||
rm "${ED}/usr/bin/iptables-xml" || die
|
|
||||||
|
|
||||||
dodoc iptables/iptables.xslt
|
|
||||||
|
|
||||||
# All the iptables binaries are in /sbin, so might as well
|
|
||||||
# put these small files in with them
|
|
||||||
into /
|
|
||||||
dosbin iptables/iptables-apply
|
|
||||||
dosym iptables-apply /sbin/ip6tables-apply
|
|
||||||
doman iptables/iptables-apply.8
|
|
||||||
|
|
||||||
insinto /usr/include
|
|
||||||
doins include/ip{,6}tables.h
|
|
||||||
insinto /usr/include/iptables
|
|
||||||
doins include/iptables/internal.h
|
|
||||||
|
|
||||||
keepdir /var/lib/ip{,6}tables
|
|
||||||
newinitd "${FILESDIR}"/${PN}-r3.init iptables
|
|
||||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
|
||||||
dosym iptables /etc/init.d/ip6tables
|
|
||||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
# Bug #647458
|
|
||||||
rm "${ED}"/etc/ethertypes || die
|
|
||||||
|
|
||||||
# Bugs #660886 and #669894
|
|
||||||
rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
|
|
||||||
fi
|
|
||||||
|
|
||||||
systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
|
|
||||||
|
|
||||||
# Move important libs to /lib, bug #332175
|
|
||||||
gen_usr_ldscript -a ip{4,6}tc xtables
|
|
||||||
|
|
||||||
find "${ED}" -type f -name "*.la" -delete || die
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_postinst() {
|
|
||||||
local default_iptables="xtables-legacy-multi"
|
|
||||||
if ! eselect iptables show &>/dev/null; then
|
|
||||||
elog "Current iptables implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect iptables set "${default_iptables}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if use nftables; then
|
|
||||||
local tables
|
|
||||||
for tables in {arp,eb}tables; do
|
|
||||||
if ! eselect ${tables} show &>/dev/null; then
|
|
||||||
elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
|
|
||||||
eselect ${tables} set xtables-nft-multi
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
eselect iptables show
|
|
||||||
}
|
|
||||||
|
|
||||||
pkg_prerm() {
|
|
||||||
if [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Unsetting iptables symlinks before removal"
|
|
||||||
eselect iptables unset
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/ebtables'; then
|
|
||||||
elog "Unsetting ebtables symlinks before removal"
|
|
||||||
eselect ebtables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting ebtables symlinks to ebtables-legacy"
|
|
||||||
eselect ebtables set ebtables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! has_version 'net-firewall/arptables'; then
|
|
||||||
elog "Unsetting arptables symlinks before removal"
|
|
||||||
eselect arptables unset
|
|
||||||
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
|
|
||||||
elog "Resetting arptables symlinks to arptables-legacy"
|
|
||||||
eselect arptables set arptables-legacy
|
|
||||||
fi
|
|
||||||
|
|
||||||
# The eselect module failing should not be fatal
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
Loading…
x
Reference in New Issue
Block a user